I had a theory on this, and spent a good 20+ minutes typing it all out... but as I was typing it I realized parts of it weren't making sense to me, so rather than make a confusing situation even worse, I decided that my theory *may* be right, but probably not. Let's dig a little deeper before I can figure out if it's even logical or not at this point.
If we ignore VRs for a minute, this behavior doesn't happen on my boxes. Like I mentioned in my previous post, if I ping an interface address of one of my SRXs, that's where the reply comes from.
Are you doing any FBF (filter-based forwarding) / policy-based routing between VRs? Can you run the flow debug on both SRXs and see where the address seems to change and how many times it changes, and compare that with how the traffic looks if you ping from Host A to Host B rather than to the SRX itself?
Can you add another interface into the same VR-2 as your untrust interface and ping that, and see if you get the same address-changing oddness? That might help determine if this is related to VRs or VR crossing or not.
Also, can you post your configs, any more detail on the diagram, and any helpful output such as a "show route" and the debug flow outputs so we can see how traffic is moving through the systems?